Almost every employee in virtually every business worldwide has an email account. It’s the largest platform for online communication that exists. With the huge personnel numbers and a vast attack area landscape, email is the perfect target for money-hungry hackers. This is especially true for CPA firms. Why? Email accounts of CPAs are chock full of personal and financial information – a hacker’s jackpot.
With email hacking on the rise and CPAs a pointed target, how can you protect your firm? This blog will cover essential email hacking prevention tips that specifically strengthen the security of CPA firms.
CPA Email Accounts: A Target for Cybercriminals
Did you know that email is the number one target for CPA firms? It’s easy to compromise and easy to target. Let’s break down why this is.
While there are countless different applications a CPA firm may use, one thing is true of 99% of businesses worldwide: they have an email account. So, while hackers could guess if a firm is using Quickbooks and figure out a way to hack their accounts, if they find a strategy to compromise email accounts, there is a 99% certainty an employee will have an email account. What’s more, email is boiled down to two leading providers in the CPA space: Google and Office 365. Hackers can figure out how to compromise just one of these platforms and be able to hack half of CPA firms. For hackers, it’s a simple numbers game.
Secondly, hackers can do a lot of damage when they gain access to an email. Hackers can impersonate and propagate malicious actions once in an email account.
How Do Hackers Infiltrate CPA Email Accounts?
Hacking a CPA email account isn’t quite as easy as guessing a lucky password. Hackers can rely on user error (i.e. weak passwords, click links) and phishing to illicitly gain access to email accounts.
#1- Weak Passwords
More often than not, the gateway to email hacking is a weak user password. As is true with accounts other than email, a strong password is vital for security. So, what makes a good email password?
Long alphanumeric passwords with a mix of characters , numbers and both lower and upper-case letters are always stronger. Avoid common passwords that include your name, address, birthday, or other personal details that might be garnered from social media.
Additionally, you should update your passwords on a regular schedule and use different passwords for different accounts. Your email account should have its own unique password that is only used for accessing your email account.
#2- Phishing
Phishing emails typically request immediate action from the email account holder with the risk of something bad happening.
Scenario: user receives an email saying that it’s detected spam messages in your inbox. Your account will be blocked if you don’t verify your mailbox.
The goal of this phishing scam is to get the user to click the link so they can send you to a fake version of, for example, the Office 365 website. Once there, the user hands over their username and password to “verify” their inbox. And just like that, the hackers are in.
How to Secure CPA Emails
We touched on ten specific tips to prevent email hacking in our last blog. From a more macro view, CPA firms need to be looking at the organizational habits of their employees. With a growing remote workforce, firms are faced with a unique set of vulnerabilities they need to address.
Yes – multi-factor authentication and strong passwords are a given. If your firm isn’t prioritizing this, the need has existed for ten years or more. Still, better late than never!
The next level is to take a look at location access and organizational practices. From where are employees gaining access to their email? Are the locations secure? Has your organization developed standardized rules and practices around email access?
The final piece is employee education. All of the above can be summed up under the umbrella of educating your employees. Yes, anti-virus software is helpful. Yes, your IT team should be monitoring your systems. But at the end of the day, the greatest risk to any organization is its “humans”. Educating those “humans” (read: employees and c-suite individuals alike) will be your greatest protection from email hacking.
Protect Your CPA Firm’s Email Accounts
As one of the top targets for CPA firms, email remains a major point of vulnerability across the industry. Email isn’t going anywhere (and honestly, thank goodness for that!) but it is time firms prioritize email security to prevent avoidable email hacking.
At PK Tech, we have worked with countless CPA firms in over 15 years in business in the Greater Phoenix Area. We intimately understand the intricacies of what you do and the information you handle. Ready to chat about preventing email hacking at your firm? Schedule a free 10-minute chat with a member of our team today.
